IBM Using WASServiceCmd to create Windows services for WebSphere Application Servers - United States wasservice; was service; wasservice command; websphere windows service; wasservice cmd; versiongap TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 WASServiceCmd.exe is a front end for WASService.exe, which is shipped with WebSphere Application Server. WASService.exe is required in its default directory for adding, updating, and removing WebSphere Services in Windows.

Notice: In WebSphere Application Server v8 and later, this utility is shipped with the product under the name of WASServiceHelper.bat in the bin directory.
Reference:
Using the WASServiceHelper utility to create Windows services for application servers
https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/tins_wasservicecmd.html [https://www.ibm.com/support/knowledgecenter/en/SSAW57_8.5.5/com.ibm.websphere.nd.doc/ae/tins_wasservicecmd.html]

See DeveloperWorks article for detailed information: (Link at the bottom of this document)

SYMPTOM
Creating and removing a WebSphere service in Windows is confusing and error prone.

CAUSE
This application takes several parameters which can be confusing to the user along with several long path strings leaving opportunities to setup incorrectly.

ENVIRONMENT
Windows

RESOLVING THE PROBLEM

 1. Place the WASServiceCmd.exe utility in the following directory:

    install_root\bin

 2. Launch the command from the command line.

 3. The WASServiceCmd utility prompts you to select specific options and settings from a list and then calls the WASService.exe command passing all selected parameters. This greatly reduces the time it takes to create a Windows service for WebSphere Application Server and reduces the opportunity for user errors.

[/support/docview.wss?uid=swg21397335&aid=1] Flash demonstration [http://public.dhe.ibm.com/software/websphere/appserv/support/tutorials/wasservicecmd.swf]

Note: This also creates an entry in the WASServiceCmd.log in the current directory which contains the actual WASService.exe command used to create the service.

Example of a log entry:

[Fri Aug 14 12:22:01 -0500 2009] WASService.exe -add "Deployment Mgr01" -serverName "dmgr"
-profilePath "C:\Program Files\IBM\WebSphere\AppServer\profiles\Dmgr01"
-logRoot "C:\Program Files\IBM\WebSphere\AppServer\profiles\Dmgr01\logs\dmgr"
-logFile "C:\Program Files\IBM\WebSphere\AppServer\profiles\Dmgr01\logs\dmgr\WS_startdmgr.log" -encodeParams -stopArgs "-username vanno -password ****** "
-startType manual
-restart false WASServicecmd.zip [/support/docview.wss?uid=swg21397335&aid=3] [/support/docview.wss?uid=swg21397335&aid=2]

Notice: Some browsers are having trouble downloading this file and getting docview.wss instead. Download this file, then rename the file with a ".zip" extension (for example, docview.zip or WASServiceCmd.zip). You can now access the utility.
See DeveloperWorks article for more information:
The Support Authority: Take the confusion (and errors) out of creating Windows services for WebSphere Application Server [http://www.ibm.com/developerworks/websphere/techjournal/1005_supauth/1005_supauth.html]

See TroubleShooting: WebSphere Application Server (Windows Services) problems for V6.0, V6.1 and V7.0 [http://www.ibm.com/support/docview.wss?uid=swg21232884] if you are still having a problem with Windows services.

Question: How do I create a windows service for WebSphere Application Server version 7.0.X? Is there a tool that can help me create the windows service in an automated form?

Answer:
Place the WASServiceCmd.exe utility in the following directory:

    install_root\bin

 2. Launch the command from the command line.


IBM Maximo fails to start with error BMXAA4087E - United States TPAESCCD; Maximo; start; BMXAA4087E TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 BMXAA4087E - The MAXMESSAGE value for group login and key username could not be retrieved.

SYMPTOM
[ERROR] BMXAA6497E - A message for group login and key username could not be found.
com.ibm.db2.jcc.c.SqlException: No authorized routine named "ISNULL" of type "FUNCTION" having compatible arguments was found.
at com.ibm.db2.jcc.c.fg.e(fg.java:1596)
at com.ibm.db2.jcc.c.fg.a(fg.java:1206)
at com.ibm.db2.jcc.b.gb.g(gb.java:140)
at com.ibm.db2.jcc.b.gb.a(gb.java:39)
at com.ibm.db2.jcc.b.w.a(w.java:34)
at com.ibm.db2.jcc.b.vb.g(vb.java:139)
at com.ibm.db2.jcc.c.fg.n(fg.java:1177)
at com.ibm.db2.jcc.c.fg.a(fg.java:1832)
at com.ibm.db2.jcc.c.fg.a(fg.java:473)
at com.ibm.db2.jcc.c.fg.executeQuery(fg.java:457)
at psdi.server.MXServer.getMessage(MXServer.java:5362)
at psdi.server.MXServer.getMessages(MXServer.java:5538)

ENVIRONMENT
IBM DB2 database

DIAGNOSING THE PROBLEM
Connect to database back end and check the result of this query :-

select propvalue from maximo.maxpropvalue where propname='mxe.db.format.nullvalue';

If you are using DB2 database, the result should be 'COALESCE'.

RESOLVING THE PROBLEM
For IBM DB2, the value is COALESCE, and you cannot change the default value.

For Oracle, the value is NVL, and you cannot change the default value.
For SQL Server, the value must be set to ISNULL.

Make sure MXServer is stopped. Connect to database back end and update mxe.db.format.nullvalue by running following query :-

update maximo.maxpropvalue set propvalue='COALESCE' where propname='mxe.db.format.nullvalue';

Start MXServer again.

Question: Cannot start Maximo/SCCD with error BMXAA4087E - The MAXMESSAGE value for group login and key username could not be retrieved. Cannot start Maximo/SCCD with error BMXAA4087E - The MAXMESSAGE value for group login and key username could not be retrieved.

Answer:
For IBM DB2, the value is COALESCE, and you cannot change the default value.

For Oracle, the value is NVL, and you cannot change the default value.
For SQL Server, the value must be set to ISNULL.

Make sure MXServer is stopped. Connect to database back end and update mxe.db.format.nullvalue by running following query :-

update maximo.maxpropvalue set propvalue='COALESCE' where propname='mxe.db.format.nullvalue';

Start MXServer again.


IBM What are the supported Apple Macintosh Operating System Versions for IBM SPSS Statistics? - United States SPSS mac macintosh Apple Macintosh statistics OS supported version compatibility matrix leopard Snow Leopard Lion Mountain Lion 10.8 Mavericks 10.9 22 Yosemite 10.10 (Yosemite) el capitan 10.11 spss 24 Sierra 10.12 High Sierra 10.13 TECHNOTE (FAQ)

QUESTION
 I would like to know what are the supported Macintosh Operating system versions for IBM SPSS Statistics versions?

ANSWER
Please see the list below. It is strongly recommended to review the platform information on IBM Software Product Compatibility Reports [http://publib.boulder.ibm.com/infocenter/prodguid/v1r0/clarity/index.jsp]. The installation of IBM SPSS Statistics software on Apple Macintosh OSX operating systems requires an Intel processor.

A) Apple Macintosh MacOS High Sierra (10.13)

Support for IBM SPSS Statistics 25 only. Please note that no other SPSS release will be officially supported on High Sierra, but older versions like SPSS Statistics 24 may run as well on High Sierra.

NOTE: There's a known issue with some of the earlier release of Mac High Sierra system (13.0 and 13.1 beta version).
The top menu of SPSS 25 may disappear if the Mac OS system is set to Non-English.
The official MacOSX 10.13.1 version do not have this issue. So, if you encountert this issue you need to update your Mac OS version to latest official 10.13.1 build from Apple.

B) Apple Macintosh MacOS Sierra (10.12)

Support for IBM SPSS Statistics 25 and IBM SPSS Statistics 24 only. For release 24 It is also recommended to install the latest FixPack 2 for release 24 on Mac [http://www-01.ibm.com/support/docview.wss?uid=swg24043574]. [http://www-01.ibm.com/support/docview.wss?uid=swg24042675]

No older SPSS Statistics releases are supported on Sierra.

C) Apple Macintosh OSX El Capitan (10.11)

Support for IBM SPSS Statistics 24. Please see the Release notes - IBM SPSS Statistics 24.0 [http://www-01.ibm.com/support/docview.wss?uid=swg27047057] for known issues on Macintosh.

Full documentation including installation material provided in different languages and manuals for release 24 can be found on IBM SPSS Statistics 24 Documentation [http://www-01.ibm.com/support/docview.wss?uid=swg27047033] webpage.

Also, Support for IBM SPSS Statistics 23. Note: if you want to install on El Capitan, please refer to technote 1970391 [http://www-01.ibm.com/support/docview.wss?uid=swg21970391]

D) Apple Macintosh OSX Yosemite (10.10)

Support for IBM SPSS Statistics 24, IBM SPSS Statistics 23 and IBM SPSS Statistics 22

Note: Mac OSX 10.10 (Yosemite) was released on Thursday, October 16th 2014 by Apple after Statistics 22 was released. If you like to use Statistics 22 on Yosemite you need to install Statistics 22 Fixpack 2 as well. Statistics 22 FixPack 2 and release Statistics 23 are fully tested on Yosemite OSX 10.10. So if you like to run Statistics 22 on Yosemite please install Statistics 22 FixPack 2 and also read the section below:

****

In some instances it can be necessary to re-install the legacy Apple Java 6 on 10.10 for the use of Statistics 22 FixPack 2 on this platform

Download and re-install Apple Java 6

- After you upgraded your Apple Mac OSX from a previous release to 10.10, Apple Java 6 may no longer exists on your upgraded system. If you then launch Statistics 22 which is an application that relies on Java 6, it can happen, the Mac OS pops up a dialog box stating Java 6 was requested, but none is present.
- The Java dialog has a "More Info" button, which when clicked opens a browser to an Apple Tech Support page for Apple Java 2014-001. A download link is provided:
http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572]
- Click on the download link and a DMG containing the Java 6 installer is downloaded.
- Then you open the Java DMG, double click on the Java installer, follow the prompts and complete the installation of Java 6.

*******

E) Apple Macintosh OSC Mavericks (10.9)

Support for IBM SPSS Statistics 23 and IBM SPSS Statistics 22

***

Note: IBM SPSS Statistics 22 was developed and released prior to Apple's release of OS X 10.9 (Mavericks). However, Statistics 22 can be installed on Mac OSX 10.9 if you install Apple Java SE 6 (1.6.0_65) on OS X 10.9 first before you install Statistics 22. Please see http://support.apple.com/kb/dl1572 [http://support.apple.com/kb/dl1572] for download.

****

F) Apple Macintosh OSX Mountain Lion (10.8)

Support for IBM SPSS Statistics 22 and IBM SPSS Statistics 21

****

G) Apple Macintosh OSX Lion (10.7)

Support for IBM SPSS Statistics 21

H) Apple Macintosh OSX Snow Leopard (10.6)

Support for IBM SPSS Statistics 21

Older SPSS Statistics releases 18 and 19 and 20:

Please note that SPSS Statistics releases 18, 19 and 20 are no longer supported by IBM. Please contact IBM Sales department to renew your contracts.

RELATED INFORMATION
 Need more help? Our Statistics forum is Live! [https://developer.ibm.com/answers/topics/statistics.html?smartspace=predictive-analytics]

Question: Cannot Authorize SPSS 19 Installation on New Computer,Need to Authorize SPSS 19 on a New Computer I'm currently using SPSS 19 and need to install it on a new computer, however, it will not authorize. I've spoken to SPSS support by phone but they recommended checking here. I'm running on a Mac, OS X Sierra, for SPSS 19. Would someone please be able to assist?,I'm currently running SPSS 19 and need to install it on a new computer. When I try to authorize it, it fails. I've spoken to SPSS over the phone to no avail. I'm running OS X Sierra. Could anyone please help?

Answer:
Apple Macintosh MacOS Sierra (10.12)

Support for IBM SPSS Statistics 25 and IBM SPSS Statistics 24 only. For release 24 It is also recommended to install the latest FixPack 2 for release 24 on Mac [http://www-01.ibm.com/support/docview.wss?uid=swg24043574]. [http://www-01.ibm.com/support/docview.wss?uid=swg24042675]

No older SPSS Statistics releases are supported on Sierra.


IBM Collect troubleshooting data for the IBM Business Process Manager products - United States install; mustgather; bpm; v7.5; collect; logs; troubleshooting; v8.5 TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You are having a problem with the IBM Business Process Manager (BPM) products. You would like to know what information you must collect (MustGather) so that the IBM Business Process Manager Support team can diagnose your problem. If you gather this documentation before contacting support, it will expedite the troubleshooting process and save you time.

DIAGNOSING THE PROBLEM
Start the problem analysis:

 * Review the SystemOut.log file at install_root/profiles/profile_name/logs/server_name and look for error messages that have been logged around the time stamp when the issue showed up.
 * Search the [http://www.ibm.com/software/htp/cics/tserver/support/]appropriate product support site from the following list for known problems using symptoms such as the message number and error codes:  * IBM Business Process Manager Advanced [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Advanced]
    * IBM Business Process Manager Standard [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Standard]
    * IBM Business Process Manager Express [http://www.ibm.com/support/entry/portal/Overview/Software/WebSphere/IBM_Business_Process_Manager_Express]
    * IBM BPM Advanced Pattern for Red Hat Enterprise Linux Server [http://www.ibm.com/support/entry/portal/search_results?sn=spe&q=&filter=DC.Subject:SSV2LR]

 * Use theIBM Support Assistant [http://www.ibm.com/software/support/isa/]to search for known problems in the product documentation, forums, technotes, and so on.
 * Search the IBM dW Answers [https://developer.ibm.com/answers/topics/bpm/] or IBM Business Process Manager developerWorks community [http://www.ibm.com/developerworks/forums/forum.jspa?forumID=2382] pages for known problems.
 * If a fix is found that fits the symptoms, search Fix Central [http://www.ibm.com/support/fixcentral/] for the appropriate interim fix.

RESOLVING THE PROBLEM
Collect the following troubleshooting data if you need help from IBM Business Process Manager Support to resolve the problem.

GENERAL DIAGNOSTIC INFORMATION

Environment description:

 * IBM Business Process Manager product and version  * In Business Process Manager V7.5.x, run the versionInfo -maintenancePackages command from the bin directory of your IBM Business Process Manager product installation and redirect the output to a file.
    * In Business Process Manager V8.x, run the versionInfo -fixpacks -ifixes command from the bin directory of your IBM Business Process Manager product installation and redirect the output to a file.

 * Operating system and version
 * Database vendor and version
 * Information about other involved software
 * Production / Test / QA environment
 * If you are running in a cluster, describe the topology that you have in place. If you have a topology diagram, provide it including host names, ports, and so on.
 * Is your IBM Business Process Manager product running in a virtual machine? If yes, provide more details on the software that you are using and its version.

Detailed problem description:
Provide a precise description of the issue and add every detail that might be related.
This could include:  * Which symptoms do you see?
 * Which component or application is involved?
 * Do you see any error messages?
 * What is the time stamp when the problem occurs?
 * Did the current scenario work previously? If yes, what has been changed?
 * Is this issue reproducible at will? How often does this problem occur? Do you see any indicators on why this happens?
 * Provide screen shots if applicable (if an error message is not shown or if the specific error is not seen in the log files, and so on)

Additional details needed:
Provide the complete log directories:  * install_root/profiles/profile_name/logs/server_name
 * install_root/profiles/profile_name/logs/ffdc

Provide the configuration files:  * TeamWorksConfiguration.running.xml file, which is located in the following locations:  * Process Center profile:
      install_root/profiles/profile_name/config/cells/cell_name/nodes/
      node_name/servers/server_name/process-center
    * Process Server profile:
      install_root/profiles/profile_name/config/cells/cell_name/nodes/
      node_name/servers/server_name/process-server

 * The complete install_root/profiles/profile_name/configdirectory if requested by the support team.

Test case:  * Simplified and isolated test case without any custom dependencies and without access to external customer systems
 * *.twx export from IBM Process Designer
 * Project Interchange (PI) and enterprise archive (EAR) file from the involved Advanced Integration Services, if applicable
 * Exact, detailed steps to reproduce the problem, including timestamp of the problem occurrence.

If you have not provided it already, supply the business impact this issue is having on your company, including:  * Any upcoming deadlines and dates
 * Any realized or potential effect on customers

COMPONENT-SPECIFIC DIAGNOSTIC INFORMATION

 * Advanced Integration Service (AIS) [http://www.ibm.com/support/docview.wss?uid=swg21669894] [http://www.ibm.com/support/docview.wss?uid=swg21618716]
 * Application deployment [http://www.ibm.com/support/docview.wss?uid=swg21618716]
 * Application deployment (EAR file / Advanced content) [http://www.ibm.com/support/docview.wss?uid=swg21959495]
 * Business Process Choreographer (BPC) [http://www.ibm.com/support/docview.wss?uid=swg21270939]
 * Business Process Definition (BPD) [http://www.ibm.com/support/docview.wss?uid=swg21680148]
 * IBM Business Process Manager Advanced Pattern for AIX and Linux [http://www.ibm.com/support/docview.wss?uid=swg21642204]
 * IBM Business Process Manager document store [http://www.ibm.com/support/docview.wss?uid=swg21640607] (for IBM Business Process Manager V8.5.x)
 * IBM Business Process Manager on Cloud [http://www.ibm.com/support/docview.wss?uid=swg21664113]
 * Business Rules [http://www.ibm.com/support/docview.wss?uid=swg21663864]
 * Business Space [http://www.ibm.com/support/docview.wss?uid=swg21578516]
 * Coaches [http://www.ibm.com/support/docview.wss?uid=swg21666382]
 * Common Event Infrastructure (CEI) [http://www.ibm.com/support/docview.wss?uid=swg21670009]
 * Connection to Process Center [http://www.ibm.com/support/docview.wss?uid=swg21666261]
 * Data Map, Data Object and XML Serialization [http://www.ibm.com/support/docview.wss?uid=swg21664250]
 * Database [http://www.ibm.com/support/docview.wss?uid=swg21610455]
 * Dynamic Event Framework (DEF) [http://www.ibm.com/support/docview.wss?uid=swg21679783]
 * Installation and upgrade [http://www.ibm.com/support/docview.wss?uid=swg21506937]
 * Integration between IBM Business Process Manager (BPM) and IBM ILOG or IBM WebSphere Operational Decision Management [http://www.ibm.com/support/docview.wss?uid=swg21644787]
 * Message import and export (MQ and JMS related) [http://www.ibm.com/support/docview.wss?uid=swg21667053]
 * Migration [http://www.ibm.com/support/docview.wss?uid=swg21663802]
 * Out-of-memory, hangs, crashes [http://www.ibm.com/support/docview.wss?uid=swg21666135]
 * Performance [http://www.ibm.com/support/docview.wss?uid=swg21611603]
 * Performance Data Warehouse [http://www.ibm.com/support/docview.wss?uid=swg21609319]
 * Process Admin console [http://www.ibm.com/support/docview.wss?uid=swg21661316]
 * Process Designer [http://www.ibm.com/support/docview.wss?uid=swg21611598]
 * Process Inspector [http://www.ibm.com/support/docview.wss?uid=swg21666266]
 * Process Portal [http://www.ibm.com/support/docview.wss?uid=swg21656267]
 * REST API [http://www.ibm.com/support/docview.wss?uid=swg21666278]
 * Secure Sockets Layer (SSL), Java Secure Socket Extension (JSSE) or Java Cryptography Extensions (JCE) [http://www.ibm.com/support/docview.wss?uid=swg21162961]
 * Security [http://www.ibm.com/support/docview.wss?uid=swg21609418]
 * Service Component Architecture (SCA), Service Integration Bus (SIB) or Failed Event Manager (FEM) [http://www.ibm.com/support/docview.wss?uid=swg21669111]
 * Undercover Agent (UCA) [http://www.ibm.com/support/docview.wss?uid=swg21660915]
 * Web services [http://www.ibm.com/support/docview.wss?uid=swg21593461]

Note: In the previous information, the install_root refers to the location in which you installed the product. The profile_name is the name of the profile that is specific to your configuration. The cell_name, node_name and server_name are the names of the cell, the node and the server that are specific to your configuration.
AUTOMATIC DATA COLLECTION VIA THE BPM DATA COLLECTOR

You can also use the BPM Data Collector [http://www.ibm.com/support/docview.wss?uid=swg21641516] to automatically collect basic MustGather data like logs, version info and so on. Verify the created package if any requested information is missing prior to sending it to IBM Support for problem analysis.
This tool can be used with IBM Business Process Manager V8.0.1 Fix Pack 3 and with IBM Business Process Manager V8.5.x.

RELATED INFORMATION
 Exchange data with IBM Technical Support [http://www.ibm.com/de/support/ecurep/index.html]
BPM Advanced - System requirements [http://www.ibm.com/support/docview.wss?uid=swg27023005]
BPM Standard - System requirements [http://www.ibm.com/support/docview.wss?uid=swg27023007]
BPM Express - System requirements [http://www.ibm.com/support/docview.wss?uid=swg27023008]
Recommended fixes for IBM BPM [http://www.ibm.com/support/docview.wss?uid=swg27022299]
Configuration file overview [http://www.ibm.com/support/docview.wss?uid=swg21439614]
MustGather for WebSphere Application Server [http://www.ibm.com/support/docview.wss?uid=swg21145599]
Troubleshooting data: WebSphere Process Server [http://www.ibm.com/support/docview.wss?uid=swg21239895]
Troubleshooting data: IBM Integration Designer [http://www.ibm.com/support/docview.wss?uid=swg21566742]
Troubleshooting data: WebSphere ESB [http://www.ibm.com/support/docview.wss?uid=swg21268473]
Troubleshooting data: WebSphere Lombardi Edition [http://www.ibm.com/support/docview.wss?uid=swg21440086]
Troubleshooting data: IBM Business Monitor [http://www.ibm.com/support/docview.wss?uid=swg21498803]
A Japanese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21620654]
A simplified Chinese translation is available [http://www.ibm.com/support/docview.wss?uid=swg21634198]

Cross reference information Segment Product Component Platform Version Edition Business Integration IBM Business Process Manager Standard Documentation AIX, Linux, Solaris, Windows 8.5.7, 8.5.6, 8.5.5, 8.5, 8.0.1, 8.0, 7.5.1, 7.5 Business Integration IBM Business Process Manager Express Documentation Linux, Windows 8.5.7, 8.5.6, 8.5.5, 8.5, 8.0.1, 8.0, 7.5.1, 7.5 Business Integration IBM BPM Advanced Pattern on Red Hat Enterprise Linux Server Documentation Linux 8.5.0.1, 8.0.1, 8.0 Business Integration IBM Business Process Manager Advanced Pattern on AIX Documentation AIX 8.0.1
PRODUCT ALIAS/SYNONYM
 BPM

Question: What is the best practice for working with BPM support When working with the BPM product set there are a lot of configuration files, logs and applications which can be exported for analysis by the support team. What are the best practices for working with the BPM support team?

Answer: Collect the following troubleshooting data if you need help from IBM Business Process Manager Support to resolve the problem.


IBM Security Bulletin:IBM Integration Bus is affected by deserialization RCE vulnerability in IBM WebSphere JMS Client - United States IIB SECURITY BULLETIN

SUMMARY
 WebSphere MQ V9.0 libraries are shipped in IBM Integration Bus and hence IBM Integration Bus is vulnerable to IBM WebSphere MQ JMS client deserialization RCE vulnerability.

VULNERABILITY DETAILS

CVEID: CVE-2016-0360 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0360]
DESCRIPTION: IBM Websphere MQ JMS client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111930 [https://exchange.xforce.ibmcloud.com/vulnerabilities/111930] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Please consult the security bulletin IBM WebSphere MQ JMS client deserialization RCE vulnerability [https://www-01.ibm.com/support/docview.wss?uid=swg21983457] for more details
.

AFFECTED PRODUCTS AND VERSIONS
IBM Integration Bus V10.0.0.0 to V10.0.0.9, and V9.0.0.0 to V9.0.0.8

REMEDIATION/FIXES

Product VRMF APAR Remediation/Fix IBM Integration Bus V10.0.0.0 to V10.0.0.9 IT21160 The APAR is available in fix pack 10.0.0.10
http://www-01.ibm.com/support/docview.wss?uid=swg24043943 [http://www-01.ibm.com/support/docview.wss?uid=swg24043943] IBM Integration Bus V9.0.0.0 to V9.0.0.8 IT21160 The APAR is available in fix pack 9.0.0.9
http://www-01.ibm.com/support/docview.wss?uid=swg24043947 [http://www-01.ibm.com/support/docview.wss?uid=swg24043947]
Remediation for users of versions V9.0.0.7, V10.0.0.8 and above:
If MQ JMS is used, then you are applicable to this vulnerability. To get around this vulnerability, the following steps are required
1. Apply the fix for IBM Integration Bus APAR IT21160
2. Specify the whiltelist classes as below

mqsichangeproperties <INode> -e <IServer> -o ComIbmJVMManager -n jvmSystemProperty -v <full qualified class names in comma separated form>

eg : mqsichangeproperties <INode> -e <IServer> -o ComIbmJVMManager -n jvmSystemProperty -v \ "-Dcom.ibm.mq.jms.whitelist=com.ibm.broker.class1,com.ibm.broker.class2,com.ibm.broker.classn\"

Remediation for users of versions prior to V10.0.0.8 and V9.0.0.7:
You will need to update MQ. Consult the security bulletin IBM WebSphere MQ JMS client deserialization RCE vulnerability [https://www-01.ibm.com/support/docview.wss?uid=swg21983457] for details.

WORKAROUNDS AND MITIGATIONS
None

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v3 Guide [http://www.first.org/cvss/user-guide]
On-line Calculator v3 [http://www.first.org/cvss/calculator/3.0]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

ACKNOWLEDGEMENT
The vulnerability was reported to IBM by Matthias Kaiser of Code White (www.code-white.com)

CHANGE HISTORY
 29 September 2017: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

PRODUCT ALIAS/SYNONYM
 IIB

Question: Help with Security Bulletin: IIB is affected by deserialization RCE vulnerability in IBM WebSphere JMS Client I need to understand details regarding Security Bulletin:IBM Integration Bus is affected by deserialization RCE vulnerability in IBM WebSphere JMS Client (related to CVEID: CVE-2016-0360). Where can I find this information?

Answer:
CVEID: CVE-2016-0360 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0360]
DESCRIPTION: IBM Websphere MQ JMS client provides classes that deserialize objects from untrusted sources which could allow a malicious user to execute arbitrary Java code by adding vulnerable classes to the classpath.
CVSS Base Score: 8.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111930 [https://exchange.xforce.ibmcloud.com/vulnerabilities/111930] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)


IBM CICS Transaction Server for z/OS 3.1 and 3.2 End of Support announcement - United States CICS TS 3.2 3.1 ; EOS; end of support; out of support; product lifecyle; end of lifecycle; withdrawal from support; withdrawn from support ; out of support; withdrawal announcement letter 5655M1500 R640 640 R400 400 HCI6400 R650 650 R500 500 HCI6500 5655-M15 5655M15; KIXINFO retention32 PRODUCT LIFECYCLE

ABSTRACT
 CICS Transaction Server for z/OS (CICS TS) V3.1 and V3.2 was withdrawn from support 31 December 2015. CICS TS Service Flow Feature V3.1 was also be withdrawn from support on the same date. This document contains a link to the Software service discontinuance announcement letter and product replacement information.

CONTENT
The Software service discontinuance announcement letter that says CICS TS V3.1, CICS TS V3.2, and CICS TS Service Flow Feature V3.1 was withdrawn from support 31 December 2015 is 913-075 [http://www.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&supplier=897&letternum=ENUS913-075].

The following product replacement information is included in this announcement:

Program Program
Withdrawn program number Replacement program number

CICS TS V3.1 5655-M15 CICS TS V4.2 5655-S97

CICS TS V3.2 5655-M15 CICS TS V4.2 5655-S97

CICS TS Service CICS TS Service Flow
Flow Feature V3.1 5655-M15 Feature V3.2 5655-M15

Note: For additional information, refer to Software Announcement 211-080 [http://www.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&appname=gpateam&supplier=897&letternum=ENUS211-080], dated April 05, 2011 . CICS TS V5.1 is also available and may be considered as a replacement product for CICS TS V3. For details, refer to Software Announcement 212-325 [http://www.ibm.com/common/ssi/cgi-bin/ssialias?infotype=an&subtype=ca&appname=gpateam&supplier=897&letternum=ENUS212-325], dated October 03, 2012 .

See the Announcement Letters for CICS products [http://www.ibm.com/support/docview.wss?uid=swg21227090] if you are interested in upgrading to the latest release of CICS TS or any other CICS products.

A fee based service extension for CICS TS for z/OS V3.1 or V3.2 might be available from IBM, if you need more time to upgrade. A service extension entitles you to continue to receive the level of support that you receive today using the same channels into IBM, including raising PMRs and APARs. If you would like to find out more about CICS service extensions, contact your local IBM Sales Representative:

 * US Customers, contact Customer Support Operations at 877-426-6006 option #2. If you give the support representative your customer number they can find your sales representative.

 * Customers in other geographies should refer to the IBM directory of worldwide support contacts to find sales contact numbers in your region.
   IBM directory of worldwide support contacts [http://www.ibm.com/planetwide/]

For more information about the availability of support extensions see IBM software support lifecycle policy [http://www.ibm.com/software/support/lifecycle/lc-policy.html] page.
RELATED INFORMATION
 Announcement letters for CICS products [http://www.ibm.com/support/docview.wss?uid=swg21227090]
End of Service dates for CICS products [http://www.ibm.com/support/docview.wss?uid=swg21154953]
CICS TS 4.1 and 4.2 End of Service dates [https://developer.ibm.com/answers/questions/182094/cics-transaction-server-for-zos-41-and-42-end-of-s.html]

PRODUCT ALIAS/SYNONYM
 CICS/TS CICS TS CICS Transaction Server

Question: End of support date for CICS TS 3.2 change from 2016 to 2015 Did the end of support date for Transaction Server for z/OS (CICS TS) 3.2 change in June 2015? Earlier this year, the date was December 2016 now it appears to be December 2015!

Answer: The Software service discontinuance announcement letter that says CICS TS V3.1, CICS TS V3.2, and CICS TS Service Flow Feature V3.1 was withdrawn from support 31 December 2015 is 913-075


IBM TroubleShooting: JavaServer Pages (JSP) problems - United States JSPs; TroubleShootingDocument; troublehooting TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 Troubleshooting JSP problems for WebSphere® Application Server. This should help address common issues with this component before calling IBM support and save you time.

RESOLVING THE PROBLEM
The following are some examples of common JSP problems and some basic information on how to resolve them:

 * java.io.FileNotFoundException: JSPG0036E: Failed to find resource
   If the browser displays a JSPG0036E: Failed to find resource message, the JSP processor cannot find the specified JSP page in the Web module, as shown below.

   java.io.FileNotFoundException: JSPG0036F: Failed to find /Tests/index.jsp
   at com.ibm.ws.jsp.webcontainerext.JSPExtensionProcessor.findWrapper (JSPExtensionProcessor.java:246)
   at com.ibm.ws.jsp.webcontainerext.JSPExtensionProcessor.handleRequest (JSPExtentionProcessor.java:228)
   ...
   Take following steps to verify URL being requested order to debug this exception:

   To determine the URL of the installed application, you need to use the administrative console to view the configuration of a number of items. The format of the URL is as follows:

   http://host:port/context_root/resource_name
   Finding <host>:<port>
   When a Web module is installed, a virtual host is associated with it. To find the virtual host using the WebSphere Application Server administrative console:  1. Select Applications > Application type > WebSphere Enterprise Applications.

    2. Select the application name to open the details page.

       In the Web module Properties section, click Virtual hosts.

    3. Note the virtual hosts that are used by the specified application Web module.

   To find the host and port numbers that are valid for the virtual host:  1. Select Environment > Virtual Hosts.

    2. Choose the virtual host, and then under Additional Properties, click Host Aliases.

    3. The list contains the host name and port combinations that can be used to access this virtual host. The host name column should contain values that are registered in a DNS server as a host name for the WebSphere Application Server. An asterisk (*) in the host column indicates that any name can be used. In this case, use the server host name.

   Finding <context_root>
   The context root is the Web application root and is used to identify the application in the URI. To find the context root:  1. In the WebSphere Application Server administrative console, click Applications > Application type > WebSphere Enterprise Applications.

    2. Select the target application, then under Detail Properties, click View Deployment Descriptor.

    3. Review the <context-root> tag for the specified Web module in the related deployment descriptor tag.

   Finding <resource_name>
   To find the initial file for the application (for example, index.jsp), you can look at the welcome file list in the Web deployment descriptor. As per J2EE specification, JSP files should reside under web module root or under sub directory other than META-INF and WEB-INF.

   For example:  * Web module root :

      install_root\profiles\profile_name\installedApps<CELL>\<EAR>\<WAR>

   In the preceding case, the index.jsp file should reside uner Web_module_root/Test directory. If not, than it explains this error message.

 * JSP not reloading
   If, after modifying and saving a JSP file, the change does not show up in the browser, you need to check the reload settings in the Web module configuration and the JSP runtime reload settings. For the JSPs, the Web container reloads a Web module only when the IBM extension reloadingEnabled in the ibm-web-ext.xmi file is set to true.

   The following is an example of web module reloading settings in the ibm-web-ext.xmi file:

   <webappext:WebAppExtension xmi:version="2.0" xmlns:xmi="http://www.omg.org/XMI" xmlns:webappext="webappext.xmi" xmi:id="WebAppExtension_1109270589179" reloadInterval="3" reloadingEnabled="true" fileServingEnabled="true">
   Location of the ibm-web-ext.xmi file :

   install_root\profiles\profile_name\config\cells\cell_name
   \applications\<EAR>\deployments\app_name\<WAR>\WEB-INF\ibm-web-ext.xmi
   Configuring JSP runtime reloading:
   You have the ability to modify the JSP processor behavior for different JSP stages (such as development, testing, or production environments). This done by configuring specific attributes in the IBM Web module extensions that affect the JSP runtime reload behavior.

   JSP files can be translated and compiled at runtime when the JSP file or its dependencies are modified. This is known as JSP reloading. JSP reloading is enabled through the reloadEnabled JSP engine parameter in the ibm-web-ext.xmi configuration file.

   The JSP engine settings are stored in the ibm-web.ext.xmi file, as shown
   <jspAttributes xmi:id="JSPAttribute_1" name="reloadEnabled" value="true"/>
   <jspAttributes xmi:id="JSPAttribute_9" name="reloadInterval" value="3"/>

 * Encoding and internationalization issues
   Encoding and internationalization problems usually showup as garbage characters in Web pages and input from user interpreted incorrectly. Double Byte Character Set (DBCS) character processing is a common issue for encoding problems. DBCS is used for languages such a Chinese, Korean, and Japanese, where a single byte is not sufficient to represent all characters in the alphabet. Proper coding and configuration usually resolves these problems. For JSP pages, page encoding is the character encoding in which the file is encoded. For JSP pages in standard syntax, the page encoding is determined from the following sources:  1. The pageEncoding attribute of the page directive of the page
    2. The charset value of the contentType attribute of the page directive

   If none of these is provided, ISO-8859-1 is used as the default page encoding.

   Page directive implementation in JSP code:

   <HTML>
   <HEAD>
   <%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="ISO-8859-15" %>
   <META http-equiv="Content-Type" content="text/html; charset=UTF-8">
   <TITLE>Receiving parameters</TITLE>
   </HEAD>
   <BODY>
   <H1>
   Your data is <%= request.getParameter("name") %>
   </H1>
   </BODY>
   </HTML>
   The pageEncoding and contentType attributes determine the page character encoding of only the file that physically contains the page directive.

 * java.lang.IllegalStateException
   This exception is thrown when attempt is made to modify HttpServletResponse object after it has been committed.

   If you have written something in the response buffer, you cannot forward a page:

   [7/8/05 20:36:25:694 ART] 0000004f ServletWrappe E SRVE0068E: Could not invoke the service() method on servlet TestServlet. Exception thrown : java.lang.IllegalStateException
   at com.ibm.ws.webcontainer.webapp.WebAppDispatcherContext.sendRedirect(WebAppDispatcherContext.java:486)
   at com.ibm.ws.webcontainer.srt.SRTServletResponse.sendRedirect(SRTServletResponse.java:810)
   ...
   [7/8/05 20:36:25:784 ART] 0000004f SRTServletRes W WARNING: Cannot set status. Response already committed.
   Calls to the following methods, after a committing response, will cause the java.lang.IllegalStateException error to occur:  1. setBufferSize(0)
    2. reset()
    3. resetBuffer()
    4. sendError()
    5. sendRedirect()
    6. RequestDispatcher.forward() or performing jsp:forward

   Two other common variants of this exception are:
   java.lang.IllegalStateException: Header already sent
   One or more headers have been committed to the client, so you cannot set that header again.
   java.lang.IllegalStateException: OutputStream already obtained
   In case of JSP, the default output stream has always been created when the JSP has been translated to servlet. Creating and associating another output stream is the reason for this problem. The following piece of code will describe the reason for this error condition:
   try
   {
   lStream = pResponse.getOutputStream();
   lStream.write(lDocument);
   lStream.flush();
   }
   catch (java.io.IOException ioe)
   {
   logger.error("Exception writing ... to page output stream.");
   }
   finally
   {
   try
   {
   if (lStream != null)
   {
   lStream.close();
   }
   }
   catch (java.io.IOException ioe)
   {
   logger.error("Exception closing page output stream.");
   }
   }
   Two output streams cannot be associated with one JSP file.

What to do next
If the preceding troubleshooting steps did not help solve your problem, see the MustGather [http://www.ibm.com/support/docview.wss?rs=180&uid=swg21255205] for JSP problems.

Cross reference information Segment Product Component Platform Version Edition Application Servers Runtimes for Java Technology Java SDK

Question:
java.lang.IllegalStateException when I'm trying to stop a service in BPM Process Admin Console

In the Process Admin Console, under Monitoring > Process Monitor, when I try to stop a service, I get the following exception: java.lang.IllegalStateException: SRVE0199E: OutputStream already obtained

What is causing this?

Answer:
java.lang.IllegalStateException
   This exception is thrown when attempt is made to modify HttpServletResponse object after it has been committed.


IBM After upgrading to 7.0.1.0 you get SSL error AMQ9716 - United States AMQ9716 7.0.1.0 SSL OCSP SSL TECHNOTE (TROUBLESHOOTING)

PROBLEM(ABSTRACT)
 You upgrade to WebSphere MQ 7.0.1.0 (or later) and have SSL enabled channels. After the upgrade you notice that in the Queue Manager error LOGs you see the following error message:

AMQ9716: Remote SSL certificate revocation status check failed for channel '????'.
The channel does not start.

SYMPTOM
Error AMQ9716

CAUSE
With the release of WebSphere MQ V7.0.1.0 the use of OCSP certificate revocation checking was included. With this new feature, most likely your SSL certificates have a OCSP AuthorityInfoAccess (AIA) certificate extension embedded inside them.

This was ignored before V7.0.1.0. Now it is being used to verify the certificate. The most likely cause of the failure is that the system can not access the servers listed in the AIA. This then returns a UNKNOWN status when the check is done. The default action for MQ is to not allow the channel to start and the AMQ9716 to be reported when the UNKNOWN is returned.

RESOLVING THE PROBLEM
The best thing to do in this case is to determine the cause of the UNKNOWN return code and fix it.

There are two possible methods to discover which OCSP AuthorityInfoAccess URL is embedded in a certificate.

Method 1.
Place the certificate on a Windows machine; ensure to use a file extension of "crt" and double-click it. View the detail extensions for the AIA.

[/support/docview.wss?uid=swg21399255&aid=1]

Method 2
Use IBM Key Management (gskit) GUI to view them. Issue the following command::
In Windows: strmqikm
In UNIX: gsk7ikm (MQ V7) or runmqckm (MQ V8)

From the IBM Key Management window:
Select View/Edit for certificate
View Details
Extensions
AuthorityInfoAccess

[/support/docview.wss?uid=swg21399255&aid=2]

The first step would be to insure that connection to the URL in your certificate can be reached.

Work-around:
Use this only as a temporary fix until the root cause can be found.
You can do the following. It will still do OCSP checking and if REVOKED is returned then the channel will not start. A GOOD return code will allow the channel to start. If UNKNOWN is returned it will not stop the channel from starting and the AMQ9716 will not be reported.

UNIX and Linux systems add the following to qm.ini
SSL:
OCSPAuthentication=OPTIONAL

To set for a Windows Queue Manager, run the following command:
amqmdain reg YourQMgrName -c add -s SSL -v OCSPAuthentication=OPTIONAL

The OCSPAuthentication setting is also applicable to clients and can also be set in the client ini file (e.g. mqclient.ini). Changes to the client OCSPAuthentication setting will take effect after the application is restarted.

On a queue manager, users will need to issue a REFRESH SECURITY TYPE(SSL) command (or the GUI/PCF equivalent) in order for the change in SSL settings to take effect.

OCSP provides your SSL channels with additional security. Once the cause of the AMQ9716 error has been addressed then you are strongly recommended to re-enable OCSP enforcement

RELATED INFORMATION
 OCSP Info [http://www.ibm.com/support/knowledgecenter/SSFKSJ_7.1.0/com.ibm.mq.doc/sy13000_.htm?lang=en]

PRODUCT ALIAS/SYNONYM
 WMQ MQ

Question:
Getting Delay or AMQ9716: Remote SSL certificate revocation status check failed  when trying to start a MQ SSL channel, why? Getting Delay or AMQ9716: Remote SSL certificate revocation status check failed when trying to start a MQ SSL channel, please help resolve this? The error can occur on the MQ server or also a MQ client application..

AMQ9716: Remote SSL certificate revocation status check failed

Remote SSL certificate revocation status check failed for channel '???'.

EXPLANATION: WebSphere MQ failed to determine the revocation status of the remote SSL
certificate for one of the following reasons:

(a) The channel was unable to contact any of the CRL servers or OCSP responders for the certificate.
(b) None of the OCSP responders contacted knows the revocation status of the certificate.
(c) An OCSP response was received, but the digital signature of the response could not be verified.

Answer:
With the release of WebSphere MQ V7.0.1.0 the use of OCSP certificate revocation checking was included. With this new feature, most likely your SSL certificates have a OCSP AuthorityInfoAccess (AIA) certificate extension embedded inside them.

This was ignored before V7.0.1.0. Now it is being used to verify the certificate. The most likely cause of the failure is that the system can not access the servers listed in the AIA. This then returns a UNKNOWN status when the check is done. The default action for MQ is to not allow the channel to start and the AMQ9716 to be reported when the UNKNOWN is returned.


IBM OMEGAMON XE MQ Monitoring Agent Issue the ALTER QLOCAL Command - United States ALTER QLOCAL command event TECHNOTE (FAQ)

QUESTION
 We have the OMEGAMON XE for Messaging on zOS. The agent is configured to monitor all the queue managers (QMGRS) on the same lpar, however, we can see the agent sometimes issues the 'alter Qlocal' command on a QMGR. Why is the agent issuing this command?

ANSWER
When a queue full event occurs, WebSphere MQ will disable the event. To ensure that subsequent queue full events will occur, the OMEGAMON XE for Messaging agent will re-enable the queue full event once it determines the queue is no longer full via an ALTER QL(qname) QDPMAXEV(ENABLED) command. Other than Take Action commands, this is the only ALTER command that the OMEGAMON XE for Messaging agent will issue.

Question: We have the OMEGAMON XE for Messaging on zOS. The agent is configured to monitor all the queue managers (QMGRS) on the same lpar, however, we can see the agent sometimes issues the 'alter Qlocal' command on a QMGR We have the OMEGAMON XE for Messaging on zOS. The agent is configured to monitor all the queue managers (QMGRS) on the same lpar, however, we can see the agent sometimes issues the 'alter Qlocal' command on a QMGR. Why is the agent issuing this command?

Answer: When a queue full event occurs, WebSphere MQ will disable the event. To ensure that subsequent queue full events will occur, the OMEGAMON XE for Messaging agent will re-enable the queue full event once it determines the queue is no longer full via an ALTER QL(qname) QDPMAXEV(ENABLED) command. Other than Take Action commands, this is the only ALTER command that the OMEGAMON XE for Messaging agent will issue.


IBM Security Bulletin: Multiple vulnerabilities identified in IBM® Java SDK affect WebSphere Service Registry and Repository Studio (CVE-2015-4872, CVE-2015-4911, CVE-2015-4893, CVE-2015-4803) - United States  SECURITY BULLETIN

SUMMARY
 There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition that is shipped with IBM WebSphere Service Registry and Repository Studio. These issues were disclosed as part of the IBM Java SDK updates in October 2015.

VULNERABILITY DETAILS
CVEID: CVE-2015-4872 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4872]

DESCRIPTION: An unspecified vulnerability related to the Security component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107361 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107361] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)

CVEID: CVE-2015-4911 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4911]

DESCRIPTION: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107360 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107360] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-4893 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4893]

DESCRIPTION: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107359 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107359] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

CVEID: CVE-2015-4803 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4803]

DESCRIPTION: An unspecified vulnerability related to the JAXP component could allow a remote attacker to cause a denial of service.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107358 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107358] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:N/A:P)

AFFECTED PRODUCTS AND VERSIONS
 WebSphere Service Registry and Repository Studio V8.5, V8.0, V7.5 and V7.0 are affected.

REMEDIATION/FIXES
Note regarding CVE-2015-4911
This was addressed by IBM in June 2008. As a reminder, users of Java 6 and above should
refer to the IBM XL XP-J documentation [https://www-01.ibm.com/support/knowledgecenter/api/content/nl/en-us/SSYKE2_7.0.0/com.ibm.java.win.70.doc/user/xml/xlxpj_reference.html] for the javax.xml.stream.supportDTD property
for information to help avoid this vulnerability.

For all releases of WebSphere Service Registry and Repository Studio, upgrade to WebSphere Service Registry and Repository Studio V8.5.6.0_IV79089_IV80119_IV80540_IV80888 [http://www.ibm.com/support/fixcentral/swg/quickorder?parent=ibm/WebSphere&product=ibm/WebSphere/WebSphere+Service+Registry+and+Repository&release=All&platform=All&function=fixId&fixids=8.5.6.0-WS-WSRR-Studio-MultiOS-IFIV79089_IV80119_IV80540_IV80888&includeRequisites=1&includeSupersedes=0&downloadMethod=ddp&source=fc]

GET NOTIFIED ABOUT FUTURE SECURITY BULLETINS
 Subscribe to My Notifications [ http://www-01.ibm.com/software/support/einfo.html] to be notified of important product support alerts like this.

REFERENCES
Complete CVSS v2 Guide [http://www.first.org/cvss/v2/guide]
On-line Calculator v2 [http://nvd.nist.gov/CVSS-v2-Calculator]

RELATED INFORMATION
IBM Secure Engineering Web Portal [http://www.ibm.com/security/secure-engineering/bulletins.html]
IBM Product Security Incident Response Blog [http://www.ibm.com/blogs/psirt]

CHANGE HISTORY
 01 February 2016: Original version published

*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.

DISCLAIMER
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an "industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response." IBM PROVIDES THE CVSS SCORES "AS IS" WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.

Question: Help with Security Bulletin: Multiple vulnerabilities identified in IBM Java SDK affect WSRR Studio (CVE-2015-4872) I need to understand details regarding Security Bulletin: Multiple vulnerabilities identified in IBM® Java SDK affect WebSphere Service Registry and Repository Studio (CVE-2015-4872). Where can I find this information?

Answer:
CVEID: CVE-2015-4872 [http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4872]

DESCRIPTION: An unspecified vulnerability related to the Security component has no confidentiality impact, partial integrity impact, and no availability impact.
CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/107361 [https://exchange.xforce.ibmcloud.com/vulnerabilities/107361] for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:N/I:P/A:N)


IBM PI47826: VMM DOES NOT CLEAR THE CACHE IF CLEARENTITY MODE IS USED. - United States   FIXES ARE AVAILABLE
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9 [http://www-01.ibm.com/support/docview.wss?uid=swg24041819]
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10 [http://www-01.ibm.com/support/docview.wss?uid=swg24042150]
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11 [http://www-01.ibm.com/support/docview.wss?uid=swg24043005]
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24042746]
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12 [http://www-01.ibm.com/support/docview.wss?uid=swg24043844]
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14 [http://www-01.ibm.com/support/docview.wss?uid=swg24044096]
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13 [http://www-01.ibm.com/support/docview.wss?uid=swg24044479]
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15 [http://www-01.ibm.com/support/docview.wss?uid=swg24044734]

SUBSCRIBE
You can track all active APARs for this component.

APAR STATUS
 * CLOSED AS PROGRAM ERROR.

ERROR DESCRIPTION
 *  If base entry and name in repository is different and
   clearCache functionality is used with clearEntity mode then
   virtual member manager (VMM) still looks in the cache and gets
   the entity from the cache instead of fetching it from the LDAP
   server.

LOCAL FIX
 *  test fix

PROBLEM SUMMARY
 *  ****************************************************************
   * USERS AFFECTED:  All users of IBM WebSphere Application      *
   *                  Server V8.0 and V8.5 virtual member         *
   *                  manager (VMM)                               *
   ****************************************************************
   * PROBLEM DESCRIPTION: Clear cache does not work if            *
   *                      clearEntity                             *
   *                      mode is used.                           *
   ****************************************************************
   * RECOMMENDATION:                                              *
   ****************************************************************
   LDAP Clear cache functionality of VMM does not work when using
   clearEntity mode. Problems occur only if there is a different
   base entry used than the name in the repository entry.

PROBLEM CONCLUSION
 *  This APAR fixes the issue. It clears the cache properly even if
   base entry is different than name in repository.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.13 and 8.5.5.9.  Please refer to the
   Recommended Updates page for delivery information:
   http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980 [http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980]

TEMPORARY FIX

COMMENTS

APAR INFORMATION
 * APAR NUMBER
   PI47826

 * REPORTED COMPONENT NAME
   WEBS APP SERV N

 * REPORTED COMPONENT ID
   5724H8800

 * REPORTED RELEASE
   800

 * STATUS
   CLOSED PER

 * PE
   NoPE

 * HIPER
   NoHIPER

 * SPECIAL ATTENTION
   NoSpecatt / Xsystem

 * SUBMITTED DATE
   2015-08-28

 * CLOSED DATE
   2015-12-09

 * LAST MODIFIED DATE
   2015-12-09

 * APAR IS SYSROUTED FROM ONE OR MORE OF THE FOLLOWING:

 * APAR IS SYSROUTED TO ONE OR MORE OF THE FOLLOWING:

FIX INFORMATION
 * FIXED COMPONENT NAME
   WEBS APP SERV N

 * FIXED COMPONENT ID
   5724H8800

APPLICABLE COMPONENT LEVELS
 * R800 PSY
   UP

 * R850 PSY
   UP

Question:
Why is the reload() not clearing the attribute cache so I can see my newly updated LDAP data in real time? You are leveraging the reload() functionality as described in the blog post:
  https://www.ibm.com/developerworks/community/blogs/PortalL2Thoughts/entry/how_to_programatically_refresh_data_from_ldap64?lang=en

to refresh the attribute cache after a change has been made to data within your LDAP. The purpose of this reload() is to update the data in real time on the Portal server. You discover that you are calling the reload(); however, the newly updated data is not immediately available to the application. How can this be fixed?

Answer:
This APAR fixes the issue. It clears the cache properly even if
   base entry is different than name in repository.

   The fix for this APAR is currently targeted for inclusion in
   fix packs 8.0.0.13 and 8.5.5.9.